Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects PowerShell execution involving Node.js related artifacts such as downloads from nodejs.org, extraction of specific Node.js archive versions, or interaction with Node.js installation directories. This activity is indicative of potential unauthorized software installation or preparation for execution of Node.js-based applications or tools on a Windows system.
Detects indicators of the DragonReturn malware campaign, specifically the download and deployment of malicious payloads hidden within image files. The rule monitors for network connections to known malicious infrastructure, the creation of specific steganographic staging files in sensitive directories, and the use of the URLDownloadToFile API to retrieve these payloads.
Detects a suspicious PowerShell command sequence involving network downloads to temporary directories followed by the execution of a Node.js binary from within the user's AppData directory within a 30-minute window. This behavior is indicative of a dropper pattern where a malicious script retrieves and executes a secondary stage payload.
Detects the use of certutil.exe to download files from remote URLs using the -urlcache flag or decode files using the -decode flag. This behavior is indicative of a living-off-the-land technique used by adversaries to fetch or prepare malicious payloads.
Detects instances of curl.exe being executed by suspicious parent processes (such as shells, scripting engines, or Office applications) while using command-line arguments to download files from remote URLs to sensitive or common directory paths. This behavior is indicative of a living-off-the-land (LOLBin) attack pattern used to stage malicious payloads.
Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.
Detects instances of curl.exe being executed by suspicious parent processes (such as shells, scripting engines, or Office applications) while using command-line arguments to download files from remote URLs to sensitive or common directory paths. This behavior is indicative of a living-off-the-land (LOLBin) attack pattern used to stage malicious payloads.
Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.
Detects a malicious browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as Perplexity AI. The rule identifies the extension installation followed by a two-hop network redirect sequence: the browser is first directed to a malicious domain (perplexity-ai.online) which logs user metadata, then immediately redirected to a ZIP file download lure on a different domain. This behavior is correlated within a 30-minute window for a specific browser process.
Detects instances where 'Cursor.exe' initiates a process that attempts to download content from the internet. This behavior can be indicative of malicious activity, as 'Cursor.exe' is not typically associated with network communication or file downloads.
Detects Visual Studio Code or similar IDE processes launching command-line interpreters (e.g., cmd, powershell, node, python) with suspicious command-line arguments indicative of file downloads, script execution, or network reconnaissance. This rule is designed to identify potential malicious extensions or compromised development environments.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Detects cmd.exe invoking curl.exe to download payloads from raw.githubusercontent.com, a technique commonly used for retrieving multi-stage scripts. This behavior was observed in a campaign where curl fetched secondary batch payloads from GitHub repositories into the temp directory.
Detects command-line execution containing keywords associated with Guloader (e.g., 'guloader', 'gupl') or generic download indicators (e.g., 'download' combined with protocol identifiers like 'http', 'https', 'ftp'). This typically indicates the malicious downloading of payloads by the Guloader malware family.
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
Detects cloud searches for credential, key, production, database, or confidential terms followed by access to matching files within OneDrive.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects the creation or modification of APK files in user-accessible download and temporary directories initiated by web browsers or file management applications. This behavior is indicative of potential sideloading of malicious Android applications, often used in malware delivery campaigns.
Detects the creation or modification of APK files in user-accessible download and temporary directories initiated by web browsers or file management applications. This behavior is indicative of potential sideloading of malicious Android applications, often used in malware delivery campaigns.
Detects common patterns of post-exploitation activity including downloading scripts (isp.sh) via curl/wget, executing shell commands to fetch remote payloads, running suspicious binaries from temporary directories like /var/tmp or /tmp, and persistent execution patterns.
Page 46 of 76